从老家的柜子里翻出来一台斐讯E1，老家在用的是斐讯K2P，300M宽带，房间和大部分位置wifi5足够跑满了，一直懒得升级，也足够用了。
不过发现部分位置信号比较弱，都不到50M，考虑插上E1做个AP中继，偶尔用用，当个备胎。
结果这个E1记得之前好像刷过机，但是IP地址忘了，不知道怎么连接，各种尴尬，只好尝试恢复出厂设置，但是恢复以后也一直无法连接，reset貌似也不能恢复出厂设置，这就诡异了。
虽然这破玩意也不值啥钱，其他备用设备老家也没有了，倒是还有K2P不过不在老家了，于是尝试修一下看看吧
大概率板子上都是有ttl的，于是搜了搜拆机方法：
下载breed:
K1/K1S/K2 通用，文件名：breed-mt7620-phicomm-psg1208.bin
E1使用与k2相同的breed
https://breed.hackpascal.net/breed-mt7620-phicomm-psg1208.bin
先下载一个padavan固件临时刷机用吧：
https://opt.cn2qq.com/padavan/RT-AC54U-GPIO-1-PSG1208-64M_3.4.3.9-099.trx
搜到一个斐讯系列固件网盘下载地址,留着备用吧。
斐讯系列，MTK系列刷机，华硕老毛子padavan固件和OpwenWrt路由器固件等
http://ggdkd.ysepan.com/?xzpd=1
开启ssh或telnet刷入Breed
wget http://breed.hackpascal.net/breed-mt7620-phicomm-psg1208.bin
mtd_write write breed-mt7620-phicomm-psg1208.bin Bootloader
这个貌似用不到了，目前完全起不来，留着备用吧。
E1焊接TTL
拆机参考：https://www.right.com.cn/forum/thread-267083-1-1.html
先拆4颗螺丝，然后拿薄片四周一顿撬，趴开外壳就简单了，基本上就能看到TTL接头了。
这个E1的TTL接口有2个，任意一边都能使用，拆开外壳后，网口右下角这一块就是了。
从上往下的：RX/TX/GND/VCC
从右往左的：RX/TX/GND/VCC
ttl只需要焊接3根即可： RX/TX/GND，图上并未焊接VCC
杜邦线中间剪断，另外一头母头，直接插usb to ttl小板即可。
注意：上面标注的RX/TX是指TTL小板上的段子 如接错或者无数据，可以考虑对调TX/RX即可。
macos登录串口，windows更简单，网上一堆，不废话了。
注意，波特率为57600
刚开始我盲猜9600,115200都不行，最后搜录一下搜到k2的帖子，写的波特率为57600，然后就ok了
搜波特率的时候发现的这个k2 ttl刷机的文档，除了拆机接线不一样，后面的基本相似了：
https://blog.csdn.net/TeleostNaCl/article/details/126675764
命令行找到串口设备号：
ls /dev/tty*
登录串口
screen /dev/tty.usbserial-14140 57600
(screen 退出串口： ctrl+a, k)
ttl boot log:
U-Boot 1.1.3 ( - )Board: Ralink APSoC DRAM: 64 MB
MT7620 gpio init : WPS / RESET pin
GPIO#1 updated GPIOMODE register: 001a311c -> 001a311d
relocate_code Pointer at: 83fa8000
enable ephy clock...done. rf reg 29 = 5
SSC disabled.
spi_wait_nsec: 29
spi device id: c8 40 17 c8 40 (4017c840)
Warning: un-recognized chip ID, please update bootloader!
*** Warning - bad CRC, using default environment============================================
Ralink UBoot Version: 4.3.0.0
--------------------------------------------
ASIC 7620_MP (Port5<->None)
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 64 MBytes
Flash component: SPI Flash
Date: Time:
============================================
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768##### The CPU freq = 580 MHZ ####estimate memory size =64 MbytesPress press hardware button for more than 4 seconds to run web failsafe modeCatution: hardware button wasn't pressed or not long enough!
Continuing normal boot...Please choose the operation:1: Load system code to SDRAM via TFTP.2: Load system code then write to Flash via TFTP.3: Boot system code via Flash (default).4: Entr boot command line interface.6: Load all then write to Flash via TFTP.7: Load Boot Loader code then write to Flash via Serial.9: Load Boot Loader code then write to Flash via TFTP.3: System Boot system code via Flash.
## Booting image at bc0a0000 ...Image Name: OpenWrt-Linux-3.10.14Image Type: MIPS Linux Kernel Image (lzma compressed)Data Size: 1267333 Bytes = 1.2 MBLoad Address: 80000000Entry Point: 80000000Verifying Checksum ... Bad Data CRC
镜像不能启动了，Data CRC错误，不过既然uboot是好的，那就好解决了，先试试长按reset按键，直接默认uboot网页刷固件看看是否可行
U-Boot 1.1.3 ( - )Board: Ralink APSoC DRAM: 64 MB
MT7620 gpio init : WPS / RESET pin
GPIO#1 updated GPIOMODE register: 001a311c -> 001a311d
relocate_code Pointer at: 83fa8000
enable ephy clock...done. rf reg 29 = 5
SSC disabled.
spi_wait_nsec: 29
spi device id: c8 40 17 c8 40 (4017c840)
Warning: un-recognized chip ID, please update bootloader!
*** Warning - bad CRC, using default environment============================================
Ralink UBoot Version: 4.3.0.0
--------------------------------------------
ASIC 7620_MP (Port5<->None)
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 64 MBytes
Flash component: SPI Flash
Date: Time:
============================================
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768##### The CPU freq = 580 MHZ ####estimate memory size =64 MbytesPress press hardware button for more than 4 seconds to run web failsafe modereset buootn pressed! 1 second(s)reset buootn pressed!
reset buootn pressed! 2 second(s)reset buootn pressed!
reset buootn pressed! 3 second(s)reset buootn pressed!
reset buootn pressed! 4 second(s)reset buootn pressed!
reset buootn pressed! 5 second(s)reset buootn pressed!
reset buootn pressed! 6 second(s)reset buootn pressed!
reset buootn pressed! 7 second(s)reset buootn pressed!
reset buootn pressed! 8 second(s)reset buootn pressed!
reset buootn pressed! 9 second(s)reset buootn pressed!
reset buootn pressed! 10 second(s)reset buootn pressed!hardware button was pressed for 10 seconds
HTTP server is starting for firmware update...NetTxPacket = 0x83FE4400NetRxPackets[0] = 0x83FE4A00NetRxPackets[1] = 0x83FE5000NetRxPackets[2] = 0x83FE5600NetRxPackets[3] = 0x83FE5C00NetRxPackets[4] = 0x83FE6200NetRxPackets[5] = 0x83FE6800NetRxPackets[6] = 0x83FE6E00NetRxPackets[7] = 0x83FE7400NetRxPackets[8] = 0x83FE7A00NetRxPackets[9] = 0x83FE8000NetRxPackets[10] = 0x83FE8600NetRxPackets[11] = 0x83FE8C00NetRxPackets[12] = 0x83FE9200NetRxPackets[13] = 0x83FE9800NetRxPackets[14] = 0x83FE9E00NetRxPackets[15] = 0x83FEA400NetRxPackets[16] = 0x83FEAA00NetRxPackets[17] = 0x83FEB000NetRxPackets[18] = 0x83FEB600NetRxPackets[19] = 0x83FEBC00NetRxPackets[20] = 0x83FEC200NetRxPackets[21] = 0x83FEC800NetRxPackets[22] = 0x83FECE00NetRxPackets[23] = 0x83FED400KSEG1ADDR(NetTxPacket) = 0xA3FE4400NetLoopHttpd,call eth_halt !
Trying Eth0 (10/100-M)Waitting for RX_DMA_BUSY status Start... doneETH_STATE_ACTIVE!!
HTTP server is starting at IP: 192.168.2.1
HTTP server is ready!电脑手工设置网卡ip为192.168.2.10,这个是uboot默认值，后面uboot升级时就直接连接了，不需要修改默认参数了，然后浏览器访问192.168.2.1，打开e1自带的uboot更新固件的web界面，尝试传一个网上下载的原版固件：
ETH_STATE_ACTIVE!!
HTTP server is starting at IP: 192.168.2.1
HTTP server is ready!Request for: /
Request for: /style.css
Request for: /favicon.ico
## Error: file not found!
Request for: /
Request for: /style.css
Data will be downloaded at 0x80100000 in RAM
Upgrade type: sopimg
Upload file size: 8388608 bytes
Loading: ##############################################################################...#####################################################################HTTP upload is done! Upgrading...****************************
* SOPIMG UPGRADING *
* DO NOT POWER OFF DEVICE! *
****************************Not found the header
## Error: HTTP ugrade failed!NetLoopHttpd,call eth_halt !
Trying Eth0 (10/100-M)ETH_STATE_ACTIVE!!
HTTP server is starting at IP: 192.168.2.1
HTTP server is ready!
报错了，提示Not found the header，不能升级，不折腾了，升级原版了还得root，然后再刷breed固件，索性直接uboot下更新breed即可
maos启用tftp server
Howto Start TFTP server on macOS
https://bacnh.com/howto-start-tftp-server-on-macos
sudo chmod -R 777 /private/tftpboot
cp ~/Downloads/phicom_e1/breed-mt7620-phicomm-psg1208.bin /private/tftpboot/breed.bin
sudo chmod -R 777 /private/tftpboot/breed.bin
sudo launchctl load -F /System/Library/LaunchDaemons/tftp.plisttftp -e 127.0.0.1
tftp> get breed.bin
Received 90581 bytes in 0.1 seconds
tftp> get breed1.bin
Error code 256: File not found
tftp> get breed.bin
Received 90581 bytes in 0.0 seconds
tftp> quit
然后再拨电源，再插电启动上电，因为拆机拆螺丝了，电源接头经常接触不良，导致板子不上电，于是我找了一个带开关的插排，把E1固定好，然后只需要按插排开关即可，避免来回插拨E1导致接触不良不上电。
通电以后，在ttl串口中按9，出现Y/N的提示时，先把breed放进tftp server根目录下再继续，然后通过uboot命令行刷入breed固件：
U-Boot 1.1.3 ( - )Board: Ralink APSoC DRAM: 64 MB
MT7620 gpio init : WPS / RESET pin
GPIO#1 updated GPIOMODE register: 001a311c -> 001a311d
relocate_code Pointer at: 83fa8000
enable ephy clock...done. rf reg 29 = 5
SSC disabled.
******************************
Software System Reset Occurred
******************************
spi_wait_nsec: 29
spi device id: c8 40 17 c8 40 (4017c840)
Warning: un-recognized chip ID, please update bootloader!
*** Warning - bad CRC, using default environment============================================
Ralink UBoot Version: 4.3.0.0
--------------------------------------------
ASIC 7620_MP (Port5<->None)
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 64 MBytes
Flash component: SPI Flash
Date: Time:
============================================
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768##### The CPU freq = 580 MHZ ####estimate memory size =64 MbytesPress press hardware button for more than 4 seconds to run web failsafe modeCatution: hardware button wasn't pressed or not long enough!
Continuing normal boot...Please choose the operation:1: Load system code to SDRAM via TFTP.2: Load system code then write to Flash via TFTP.3: Boot system code via Flash (default).4: Entr boot command line interface.6: Load all then write to Flash via TFTP.7: Load Boot Loader code then write to Flash via Serial.9: Load Boot Loader code then write to Flash via TFTP.You choosed 99: System Load Boot Loader then write to Flash via TFTP.Warning!! Erase Boot Loader in Flash then burn new one. Are you sure?(Y/N)Please Input new ones /or Ctrl-C to discardInput device IP (192.168.2.1) ==:192.168.2.1Input server IP (192.168.2.10) ==:192.168.2.10Input Uboot filename () ==:breed.binnetboot_common, argc= 3NetTxPacket = 0x83FE4400KSEG1ADDR(NetTxPacket) = 0xA3FE4400NetLoop,call eth_halt !NetLoop,call eth_init !
Trying Eth0 (10/100-M)Waitting for RX_DMA_BUSY status Start... doneETH_STATE_ACTIVE!!
TFTP from server 192.168.2.10; our IP address is 192.168.2.1
Filename 'breed.bin'.TIMEOUT_COUNT=10,Load address: 0x80100000
Loading: Got ARP REPLY, set server/gtwy eth addr (c0:25:a5:d2:f5:62)
Got it
##################
done
Bytes transferred = 90581 (161d5 hex)
NetBootFileXferSize= 000161d5
.
blocksize write ok i=0!
.
Done!Boot and Recovery Environment for Embedded Devices
Copyright (C) 2021 HackPascal <hackpascal@gmail.com>
Build date 2021-12-15 [git-f9b74d0]
Version 1.1 (r1337)DRAM: 64MB
Platform: MediaTek MT7620A ver 2, eco 6
Board: Phicomm PSG1208 (K1)
Clocks: CPU: 580MHz, Bus: 193MHz
Flash: GigaDevice GD25Q64 (8MB) on rt2880-spi
rt2880-eth: Using MAC address 68:db:54:dd:28:35
eth0: MediaTek MT7620A built-in 5-port 10/100M switchNetwork started on eth0, inet addr 192.168.1.1, netmask 255.255.255.0Press any key to interrupt autoboot ... 2
Autoboot aborted due to key press.Starting breed built-in shellbreed> help
Available commands:
about - About this bootloader
abstatus - Interrupt status of autoboot
arp - Display ARP table
autoboot - Detect firmware type and boot automatically
boot - Boot firmware
btntst - Test GPIO of buttons
dhcp - Display DHCP leases
env - Environment variables utility
envconf - Configure environment variable block
exit - Exit from telnet
flash - Flash utility
gpio - GPIO utilities
help - Show available commands
mdio - MDIO utility
mem - Memory operation utilities
net - Network control
netstat - Display network state
reset - Restart device
setbrg - Set baudrate
spi - SPI utility
sysinfo - Display system information
thread - Display all threads
wget - Retrieval file through HTTPbreed> sysinfo
Platform: MediaTek MT7620A ver 2, eco 6
Board: Phicomm PSG1208 (K1)
Clocks: CPU: 580MHz, Bus: 193MHz
Relocate Offset: 03eba000DRAM size: 64MB
DRAM range: 80000000 - 83ffffffKernel size: 274KB
Kernel range: 83fba000 - 83ffea6bKernel symbol table size: 1KB
Kernel symbol table range: 83fb99f0 - 83fb9ffaManaged memory size: 2MB
Managed memory range: 83db98f0 - 83fb98ef
Managed memory used: 287.34KB (14.3%)Boot parameter size: 256KB
Boot parameter range: 83d797f0 - 83db97efUnused memory size: 61MB
Unused memory range: 80000000 - 83d787efbreed> about
Boot and Recovery Environment for Embedded Devices
Copyright (C) 2021 HackPascal <hackpascal@gmail.com>
Build date 2021-12-15 [git-f9b74d0]
Version 1.1 (r1337)breed> netstat
Protocol Local Address Foreign Address State
TCP 192.168.1.1:80 0.0.0.0:0 LISTENING
TCP 192.168.1.1:23 0.0.0.0:0 LISTENINGbreed>
breed很快就刷完了，然后自动reboot，出现Press any key to interrupt autoboot … 提示时按任意键即可中止启动，进入breed提示符，然后电脑IP需要从192.168.2.10改成192.168.1.x任意地址，浏览器打开192.168.1.1，上传padavan固件， config使用公版，刷完自动重启即可。
后面基本就完事了，padavan刷完启动成功，wifi都ok了，救砖成功了。
不折腾了，拨电上螺丝，留着吃灰去了
